Security and Resilience in eHealth Infrastructures and Services

Security Challenges and Risks

About ENISA

The European Union Agency for Network and Information Security (ENISA) is a centre of network and information security expertise for the EU, its member states, the private sector and Europe’s citizens. ENISA works with these groups to develop advice and recommendations on good practice in information security. It assists EU member states in implementing relevant EU legislation and works to improve the resilience of Europe’s critical information infrastructure and networks. ENISA seeks to enhance existing expertise in EU member states by supporting the development of cross-border communities committed to improving network and information security throughout the EU. More information about ENISA and its work can be found at www.enisa.europa.eu.

Authors

Dimitra Liveri, Anna Sarri, Christina Skouloudi, ENISA

Contact

For contacting the authors please use resilience@enisa.europa.eu For media enquiries about this paper, please use press@enisa.europa.eu.

Acknowledgements

The study was conducted in cooperation with GNOMON, OtePlus and Vidavo Hellas and namely with Al. Berler, G. Makrodimitris (GNOMON); K. Panagiotakis, M. Legal (OTE Plus); El. Velidou, I. Pavlidou, P. Angelidis (Vidavo Hellas).

Legal notice

Notice must be taken that this publication represents the views and interpretations of the authors and editors, unless stated otherwise. This publication should not be construed to be a legal action of ENISA other ENISA bodies unless adopted pursuant to the Regulation (EU) No 526/2013. This publication does not necessarily represent state-of the-art and ENISA may update it from time to time.

Third-party sources are quoted as appropriate. ENISA is not responsible for the content of the external sources including external websites referenced in this publication.

This publication is intended for information purposes only. It must be accessible free of charge. Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication.

Copyright Notice

© European Union Agency for Network and Information Security (ENISA), 2015 Reproduction is authorised provided the source is acknowledged.

ISBN 978-92-9204-137-3, doi:10.2824/217830

Table of Contents

Executive Summary 5

1. Introduction 7

1.1 Policy Context 7

1.2 Scope and objectives 8

1.3 Methodology 9

1.4 Target Audience 9

1.5 Structure 10

2. eHealth Security in the Member States 11

2.1 Overview of national legislation 11

2.2 Common deployment models in EU MS 14

3. eHealth and Cyber Security 16

3.1 eHealth as a Critical Information Infrastructure 16

3.2 eHealth critical systems and assets 18

3.3 Security Challenges in eHealth 23

3.4 Information security requirements for eHealth 28

4. eHealth Use Cases 32

4.1 Overview of Use Cases 32

4.2 Use Cases analysis 35

5. Recommendations 41

5.1 Recommendations 41

5.2 Future work 43

6. Appendix - Glossary of Terms and Acronyms 44

6.1 Acronyms 44

6.2 Glossary of basic terms 46

Executive Summary

Studies have shown that cyber security incidents in eHealth systems can have a great societal impact. In a recent ENISA study, twelve out of eighteen Member States (MS) that participated in the survey- consider healthcare as a critical sector, therefore they should take all appropriate measures to protect their ICT systems and assets .

The scope and governance model of eHealth services may vary in the Member States (MS); it might be implemented as centralised or even decentralised and may be extended, offering cross-border services. Additionally, critical assets identification in the healthcare systems and infrastructures may be based on different criteria, such as business continuity, data security and integrity, services availability, eHealth security policy and legislation. Moreover usual practices, cyber security challenges, approaches to mitigate risks, and requirements for the eHealth infrastructures may converge, diverge or be inadequate.

The aim of this study is to investigate the approaches and measures MS take to protect critical healthcare systems, having as a main goal improved healthcare and patient safety. In that respect this study analyses:  The policy context in Europe and the legislation of the Member States  The perception of the Member States on critical assets in eHealth infrastructures  The most important security challenges  The most common security requirements  Relevant good practices that have been deployed in the MS for eHealth security

Cyber security incidents affecting eHealth services and infrastructures cause great impact. As a result this study focuses on the availability, continuity and resilience of these systems and infrastructures. Issues like data integrity, data protection and data confidentiality are always important when we talk about eHealth, however this study aims at presenting another side of the same coin. It is important to analyse these systems from the availability and resilience angle to understand how great the societal impact could be should, for example, a network supporting 3- 4 regional hospitals not be available.

To better understand the basic security challenges, features and applications in eHealth services, we focus on three basic use cases that are considered critical (based on a survey): Cloud Services supporting eHealth, Electronic Health Records (EHR)/Patient Health Records (PHR) and national eHealth services (i.e. ePrescription).

The following recommendations are targeted to Member State and Operators of critical eHealth infrastructures:

1. Member States should conduct an asset identification and a risk assessment to classify their critical eHealth infrastructures and services and develop a national catalogue. 2. Member States should introduce clear cyber security guidelines for the protection of their critical eHealth infrastructures and services. 3. Member States and healthcare organisations should perform an impact/cost benefit analysis of healthcare cyber security incidents and to use this as leverage for increasing investment on eHealth systems and infrastructures security. 4. Member States should develop incident response mechanisms to efficiently bring together the healthcare organisations with the national cyber security competent centres.

5. Member States and healthcare organisations should setup information sharing mechanisms to start exchanging knowledge and lessons learned on cyber security issues i.e. how they mitigate incidents, which are the security measures they take etc. 6. European Commission should encourage the development of baseline security measures for eHealth critical infrastructures and services. This should be done in coordination with the competent centres and the healthcare organisations operating the critical infrastructures.

7. Member States are encouraged to implement widely accepted security standards to achieve interoperability and provide the possibility to move towards a uniform European certification scheme.

8. Member States should invest in raising awareness of the citizens and healthcare organisations in providing cyber security training to personnel and users.

9. Member States’ policy makers should make sure that eHealth is considered as a CIIP issue and should align with the national CIIP strategy and with the National Cyber Security Strategy (NCSS).

1. Introduction

New, more effective and efficient healthcare processes are being introduced. However, in the era of “digital Darwinism” (adapt to digital or lag behind) where technology, society and operation models rapidly evolve, the healthcare operation participant experience (professional, patient) is often suboptimal. Better healthcare for the patient at a highly controllable cost should be the main goal. The complexity of eHealth systems is very high, which renders information quality (completeness, integrity), accessibility and availability a very challenging task. Emerging healthcare data sharing schemes like EHR (Electronic Health Records) or PHR (Patient Health Records) as well as cross-border scenarios further complicate the technological challenges and respective protection requirements.

The term eHealth is widely used in academia, the private and public sectors, standardisation bodies, manufacturing organisations and vendors. eHealth systems extend from regional systems, where patients can access online basic data on their treatment, to national schemes like ePrescription services or cross border eHealth information sharing.

In this report, eHealth is defined as the use of electronic means to acquire, transfer or store healthcare related information and provide services used by health professionals and consumers .

Since 2006 , many Member States, recognising the importance of this sector and the need for automation, have drafted national eHealth strategies which include important aspects for ICT adoption in the health sector; such as EHR, ePrescription, healthcare smart IDs, legal and security issues for eHealth systems, etc. In these strategies health information networks are considered a vital asset to protect; however in some cases no specific technical requirements, nor security measures nor controls have been formally established.

ENISA acknowledges the significance of eHealth not only as a major contributor to the societal and financial welfare of the EU, but more specifically as a critical information infrastructure and focuses for the first time on the security challenges and risks of ICT of the health sector in the Member States. Given that healthcare services have been recognized as a critical societal function , it is important to analyse the degree to which various eHealth systems and infrastructures are critical for the secure provision of healthcare services.

1.1 Policy Context

EHealth is a priority for the European Commission (EC): the overarching goals of the EC eHealth activities are:

 To improve citizens’ health by making life-saving information available – between countries when necessary using eHealth tools.  To increase healthcare quality and access by making eHealth part of health policy and coordinating EU countries’ political, financial and technical strategies.  To make eHealth tools more effective, user-friendly and widely accepted by involving professionals and patients in strategy, design and implementation.

In order to attain these goals, a set of policies have been put in place. Firstly, the EC has adopted the eHealth Action Plan 2012-2020, which offers a roadmap for attaining four operational objectives: (a) interoperability of eHealth services, (b) research, development and innovation, (c) uptake and wider deployment, and (d) international cooperation.

Towards achieving the cooperation among the EU MS and the interoperability between electronic health systems, the eHealth Network was set up by the Directive 2011/24/EU. The eHealth Network consists of representatives from the 28 MS and its mission is to lead the cooperation among the MS, give direction to eHealth developments and adopt guidelines (such as the Guidelines on ePrescriptions Dataset for Electronic Exchange).

Further support to the issue of interoperability is provided by the Digital Single Market Strategy, which was adopted by the EC and defines eHealth as one of the critical sectors for which priorities for security and interoperability should be set for the benefit of patients, health professional, health systems and industry.

Mobile health (mHealth) is a rapidly developing sub-segment of eHealth that covers medical and public health practice supported by mobile devices. It comprises a set of technologies which will bring a more innovative care access reducing healthcare costs at the same time. More specifically, mHealth includes the use of mobile communication devices for health and well-being services and information purposes as well as mobile health applications. The European Commission, having recognised the emergent role of mHealth in the transformation of healthcare, published in April 2014 a Green Paper on mHealth that considers existing barriers and issues related to mHealth deployment and analyses mHealth potential to maintain and improve patients' health and well-being and encourage their empowerment.

At the same time, according to the EC Directive on Critical Infrastructures , healthcare services have been recognized as a critical societal sector and therefore, healthcare systems are considered as critical infrastructures that should be protected by all types of threats, including cyber security attacks. Moreover, in the proposed NIS Directive, healthcare is considered as one of the critical sectors vital for the society.

1.2 Scope and objectives

This study focuses on eHealth information systems and infrastructures as well as on the relevant assets that are considered critical both for the society and the relevant stakeholder groups. As a starting point, this study aims to showcase how the MS perceive cyber security in their health systems, which are the specific approaches they follow and which are the measures they take to protect these systems. Examples of such systems are Healthcare information networks and systems, EHR, online ePrescription systems (supporting the drug prescription/dispensing/reimbursement cycle). Based on the criticality of these systems, the scope of this report narrows down to the availability, integrity of assets and continuity of the services.

ENISA takes stock of how Member States perceive eHealth security, which are the governance models and the specific requirements, and what are the measures they take to protect it. The aim of this study is to clarify the eHealth systems security perception in the MS; to identify the gaps and also to recommend, based on good practices, the next steps for the governmental authorities, the policy makers and specialists.

The objectives of this study are to:  Identify national legislation on cyber security and eHealth, the governing authorities and the service provider organisation;  Assess the perceived criticality of the relevant infrastructures and assets;  Present the security priorities and challenges.

1.3 Methodology

The collection of information was conducted through two parallel activities: a desk research and a series of interviews accompanied by on-line survey process, to effectively acquire and validate the feedback.  The desk research was focused on the use of ICT in eHealth, more specifically on cyber security risks, challenges and measures;  The interviews with experts to collect analytical and granular information (country, regional briefs, strategy and governance issues, security requirements and measures, CIIP, use case scenarios)  Additionally, the on-line survey targeted key experts of the field and was combined with the interviews, to get more specific information on good practices.

The stakeholders involved (representing 18 EU MS and 2 EFTA countries) were either experts in cyber security related issues or academics conducting research or operators within the field of cyber security in eHealth with the following profiles:  Public institutions responsible for eHealth strategy  eHealth Competence centres  eHealth platform Operators (CIOs, security officers, end points staff, system administrators)  Academia  User Associations – Networking organisations  Standardisation Bodies  ICT Industry (suppliers)

To better understand security risks the study assesses specific use case scenarios, seen from the CIIP point of view, based on the feedback received and the general perception. The study identifies actual instances of these scenarios which were validated by the respective stakeholders.

1.4 Target Audience

This report targets public sector experts in national authorities i.e. Ministry of Health, Ministry of State Affairs, competent Authorities (like eHealth national centres or cyber security centres) responsible for implementing the eHealth national strategy with or without mandate on cyber security and CISOs, as it offers recommendation on what are the steps to follow to protect their assets.

It is also useful for eHealth services providers (for the public sector), Operators i.e. hospitals and practitioners that use eHealth systems, as it provides advice on how they may implement security measures in their systems and what they need to do to comply with the requirements of a security policy.

1.5 Structure

Following in chapter 2, an overview of policies and strategies on eHealth with specific reference to the Member States is presented. The criticality of eHealth infrastructures, examples of identified assets on specific use cases, as well as the security challenges related to these use cases, are presented in chapter 3.

Chapter 4 analyses the proposed Use Cases in terms of their criticality and security challenges faced. This Chapter also evaluates good practices in 3 uses cases that were assessed as the most prominent ones by the stakeholder’s community. Chapter 5 present conclusions and elaborates some recommendations that could be seen either as input for future works or as issues that need to be properly addressed by the member states.

For the reader’s assistance, a glossary of used terms is introduced in the Appendix. In Annex A, published as a separate document, the reader can see the country reports, with information on eHealth systems and infrastructures security in the 28 MS.

2. eHealth Security in the Member States 2.1 Overview of national legislation

The first step to understand the perception of eHealth in the MS is to identify the landscape and how Critical Information Infrastructure Protection (CIIP) is linked to eHealth. The approaches followed vary depending on the priorities of each country. We categorise them based on the existence of an eHealth strategy, on the specific legislation and on the way cyber security is included in the eHealth national framework.

In most countries an eHealth strategy exists, following the recommendation of the first EU eHealth Action Plan requesting the Member States to setup such policy documents to describe eHealth specificities, bodies involved and their responsibilities at a national level. Overall, eHealth infrastructures protection falls under the generic umbrella of CIIP. Currently, there is no specific regulatory framework on critical eHealth infrastructure protection. This information is presented in Table 1 (further information can be found in the annexed document named “Country Reports – Current Status on eHealth in the Member States” with references).

2.2 Common deployment models in EU MS

Some MS are moving from the “healthcare data capture” stage to the “data analysis” and “data sharing” stage. The main goal is to improve healthcare via informed treatment decisions. As previously described, the “data sharing” stage involves the deployment of healthcare networks, which can securely retrieve patient data from various sources and make them available to the patient and the responsible healthcare professional. Relevant schemes like EHR and PHR, are currently trending in various MS. The eHealth models deployed in various MS vary, as analysed below:

Structural features of the model

National vs regional (or centralised vs decentralised) structures characterise eHealth in Europe. Moreover, hybrid models and loose connection (also called federation) of regional structures can be found. These features may influence both organisational and technological structures.

In some MS the eHealth model is centralised with the mandated ministry assuming the overall responsibility, whereas in other MS part and/or the entire responsibility is assigned to regional authorities. It should be noted, that in a few MS, the regions develop their own eHealth legislation and/or eHealth systems.

Hospital-system driven

This approach, identified in one EFTA European country, puts in the driving seat one of the main eHealth stakeholders, the hospitals. In this case, the hospital developed its own eHealth infrastructure and eHealth application, including a PHR application.

Cross-border use cases

Cross-border use cases have been deployed within the EU-sponsored Large Scale Project (epSOS LSP). Pilot projects on specific use cases have been evolving to official & standardized healthcare information exchanges, gaining increased traction, through ongoing EU sponsored activities. In this case the deployment model is crossing European Countries, while certain services are deployed centrally (e.g. value coding and transformation services, required to provide semantic interoperability between MSs).

3. eHealth and Cyber Security

Nowadays incidents occurring in eHealth systems that affect their availability are common. As an example, the NHS in the England has suffered six data breaches every day since 2011 study states; hospital systems and networks can be affected as every other network by viruses resulting into denial-of-service attacks and affecting for days all operations in the hospital, a common phenomenon ; malicious physical attacks can compromise data integrity and availability ; healthcare organisations are being targeted by sophisticated and highly organized cybercriminals who are showing every day how vulnerable the eHealth systems are . And the situation keeps getting more difficult. Nations should realise how vital their national eHealth systems are and take all necessary measures to protect them.

Healthcare systems are becoming vulnerable to cyber security incidents due to various reasons; the volume of information and the connection with patients dictates the use of automation and IT; the diverse nature of healthcare information systems enables different devices to access the Internet (even though not designed for this) thus making them easy targets; many outdated applications and systems didn’t include security as a priority requiring close attention of the information security officers and finally the exponentially increasing attack surface is making systems compromise an easier task. Combining these reasons with the fact that a breach of security can impact large parts of the population makes eHealth a critical sector.

The analysis of the collected information is presented in this section: the most important reasons behind classifying eHealth systems as critical are described, as well as some of the most prominent security challenges.

3.1 eHealth as a Critical Information Infrastructure

Not all MS consider eHealth as a critical sector; in some cases eHealth services formulate a different category of emergency services and are not classified as critical, in other cases healthcare ICT services are not considered critical as the environment is considered so isolated that any incident would have small impact. Criticality of eHealth infrastructure is identified through three different perspectives:

a) The first perspective, healthcare business continuity, examines which assets (infrastructures and services) are required to ensure baseline functionality of the entire eHealth system and vitality to society. Under this perspective, central components and / or services that comprise the backbone of the eHealth system are considered as critical. These components may include health provider or patients’ index service, document registries, medical databases, eHealth specific identifier services etc. b) The second perspective is data security and integrity. It examines data storage components, network elements (e.g. an access router to a site hosting the eHealth application) for exchanging health data and Identity and Access Management Systems (IAM). An analysis on specific assets for a given use case can be found in section 3.2. c) The third perspective focuses on availability. For example, if the unavailability of a service is creating high impact to the society, such as loss of life, then this service is critical. In this perspective, applications like EHR are considered to be critical, whereas network availability is crucial. Additionally, systems and services

that are directly linked to the patient’s care as diagnostic systems and Intensive Care Unit (ICU) and the systems that aggregate information related to patient’s care are considered as critical as well.

In this study, to depict the critical assets in eHealth systems, we follow the approach as described in the diagram below. First the critical eHealth service is identified. Then it is broken down to core applications, which are in turn broken down into CII assets. This is a common approach the MS could adopt to decide their focus when classifying eHealth infrastructures.

However most MS have not developed a specific methodology, legislation or regulation for the identification of critical eHealth infrastructures . Rather, the identification and protection of critical eHealth infrastructures is based on the general regulation and strategy for CIIP – wherever this is applicable.

As underlined during the stock taking, not all Member States have defined critical eHealth Infrastructures and identified relevant assets. Therefore, the process to protect the latter is based mainly on efforts of each healthcare Unit or system Operator.

3.1.1 National approaches

It should be noted that eHealth is not acknowledged as a critical sector in all Member States. In many cases, eHealth is identified as part of a critical sector such as Healthcare services and/or ICT.

Countries that identify eHealth as a critical sector address the protection of critical eHealth infrastructures according to the general legislation and guidelines that describe how national critical infrastructures should be protected and how critical data should be stored, protected and handled. In many cases infrastructure criticality is handled according to civil protection law, together with telecom infrastructure, transport communications, etc.

In most cases, the CIIP mandate lies within the organisation that is responsible for CIIP in general, while in very few cases, an eHealth organisation has a CIIP mandate. If there is no such mandate, then the responsibility is assumed by the organisation that is overall responsible for the public healthcare sector, e.g. the Ministry of Health. If there is a national security agency, and no other competent authority has a mandate on cyber security, then a common practice is that they provide cyber security expertise horizontally in all sectors.

A third approach would be the one based on voluntary initiatives/ measures by healthcare units not aligned to any th central or regional initiative (e.g. Geneva region EHR initiative leading the national EHR plan, 4 Greek RHA Healthcare Units initiatives).

From this information we conclude that there is no specific scheme when talking about critical information infrastructures protection governance, each country follows a model that is tailored to its needs. However it is very important to underline that identification of the assets and the infrastructures should be done through cooperation of the national authorities with the operators of the systems.

3.2 eHealth critical systems and assets

Having discussed the approaches followed in order to assess criticality, we present specific ICT assets which can be identified as critical for the proper operation of an eHealth system. Given that the scope of eHealth systems is very wide and the operational models and ICT implementations of a specific use case may vary, the attempt to analyse and identify assets is based on examples, to identify through them significant assets which can impact the proper operation of an eHealth system in case of failure.

Prioritise (1-5) the parameters based on which the criticality of assets is assessed

Operational models served by eHealth systems may vary in their functional aspects (e.g. a system may serve only eprescription use cases, while another may serve both e-prescription & patient summary) and/or in legal aspects since they have to follow the legal framework and organisational model of each MS. Modern heavy duty information systems are characterized by a very high technical complexity and therefore technical implementation approaches vary. Moreover, alternative design models may be followed when implementing systems (e.g. EHR systems have been designed and implemented based on alternative ICT architectures with variant centralization degrees).

Based on the information received by the interviewees, assets considered as critical are:

 Health Information systems, i.e. the information networks in the hospitals;  Clinical data repositories i.e. the databases in each hospital where information is stored locally;  Authentication server i.e. to perform access control and authentication of users;  Laboratory Information System (LIS)  Radiology Information Systems (RIS);  Picture Archiving and Communication Systems (PACS), i.e. transferring radiology results;  Electronic Health Record components;  Patient Health Record service;  ePrescription service;

We present below two examples of systems that were reported critical by all our interviewees, the EHR system and the e-Prescription.

Example A: electronic health record (EHR) system

While there is sufficient support in academic literature and analysis, there is limited standardized architectural design of an EHR. It is stated that there are centralised and distributed architectural options. Architectural options are depicted in Figure 3. The HL7 EHR functional model (FM) defines a standardised model of the functions that may

exist in EHR systems. From the outset, a clear distinction between the EHR as a singular entity and systems that operate on the EHR – i.e., EHR systems is critical .

Even though many definitions exist for EHR, the official ones, according to ISO TR 20514 health informatics electronic health record, are presented below.

EHR: A repository of information regarding the health status of a subject of care, in computer processable form. An EHR provides the ability to share patient health information between authorized users of the EHR and the primary role of the EHR is supporting continuing, efficient and quality integrated health care.

EHR system: The set of components that form the mechanism by which electronic health records are created, used, stored, and retrieved. It includes people, data, rules and procedures, processing and storage devices, and communication and support facilities.

Several EHR architectures have been deployed throughout the world . The most commonly recognized are: the centralised /fully integrated model, the decentralised/federated model and hybrids of the two models. As depicted in Figure 3, different architectural approaches are followed by those countries which have deployed EHRs. In the centralised model all the responsibilities, including cyber security, are in the mandate of one body, this might be the Ministry of health (MoH) or the national eHealth centre. They are also responsible for EHR, and all healthcare organisations (hospitals, GPs etc.) are directly reporting to them. On the other hand in the de-centralised scheme EHR is powered by the operator but instances exist in the several healthcare organisations.

In the EU, the NHS (UK) has deployed a centralised EHR architecture (called integrated EPR ). Germany, Denmark, Spain are deploying a decentralised EHR model based on a service oriented architecture, while the Netherlands are deploying a federated EHR model .

An EHR focusing on continuity of the care record (containing various patient healthcare episodes of care and respective results throughout time) will need to extract data from many sources (e.g. healthcare unit databases, eprescription systems, healthcare practitioner medical notes) as depicted conceptually in a very simplified mode in Figure 4 the ‘assets analysis’ below is based on the main ICT component categories.

When data are not persistently stored at the main EHR application, which is a common design option, then there is no single database asset involved. Therefore the resilience of the overall system is high, given that it depends neither on a single data source (several data sources are involved), nor on a single central database asset. Listed below are the critical assets that constitute the EHR system together with what will happen in case of failure and the impact an incident would cause.

Example B: e-prescription / e-dispensing system

E-Prescription systems have been mentioned during the survey by MS stakeholders as a significant eHealth initiative.

An e-prescription / e-dispensing system serves the patient’s need on the prescription and dispensing of medicine and automate/optimize the process, which is depicted in a rather simplified mode in Figure 5. The first step of the process is the patient visiting a physician, who examines the patient and prescribes medicine on the system (if needed). The second step is the patient visiting a pharmacy, which dispenses the medicine to the patient.

An e-prescription / e-dispensing system may commonly be a web-based application. Usually, e-prescription systems are based on very thorough and analytical interoperability frameworks based on international standards that allow secure and quality proofed information exchange between the systems at the different points of care. Such real world examples are deployed in countries such as Denmark, Sweden, Greece, Croatia, Finland etc.

Even though actual ICT implementations are expected to differ, best of breed ICT approaches are commonly followed, namely: redundant components at all levels to enhance resilience (three-tier architectures/web/application/database tier), deployment of primary and secondary data centre sites, enhanced perimeter and internal security measures (e.g. several types of firewalling techniques, audit logging at many levels, SIEM tools).

Such a system may be serving tens of thousands of medical doctors and pharmacies, especially when deployed at a national level. Therefore it has to be highly resilient and scalable. Service outages though not life threatening, may cause serious distress to the society. Assets critical to its operation are depicted below.

Table 3 ePrescription assets analysis

3.3 Security Challenges in eHealth

IT security in healthcare systems, services and applications is positioned as a major concern due to the high privacy and confidentiality requirements of sensitive healthcare data. EHealth faces many security challenges; the great majority of which are common to any critical infrastructure. In the interviews conducted for the purposes of the current report, the respondents were asked on which are the most important cyber security challenges in eHealth infrastructures and systems. The results are depicted below:

Which do you believe are the most important security challenges in eHealth infrastructures and systems? Systems availability

Systems availability is the basic feature for achieving continuity of electronic healthcare. It is about continuous accessibility of critical health information by authorized professionals in order to ensure the best healthcare services. Systems availability may relate to physical systems function (e.g. networks, storage) and affect significantly the healthcare delivery. In HUG (Hôpitaux Universitaires de Genève), if the network is down, the healthcare providers cannot access patient’s data and cannot prescribe. Generally, the more digitized the health sector in a country, the more the health services are affected by interruptions in eHealth infrastructures. The HUG is highly digitized (documentation, imaging, laboratory systems, patient administration systems). Therefore, network and information system availability are considered to be very critical. Systems availability may also relate to the maturity of business continuity infrastructure and process in place, namely, systems integration. A violation of the processes protocol may lead to the interruption of services. A typical example is to experience an interruption because an operator might proceed to an update without following the protocol. In this case, the impact on the continuity of services can be really high. For example, in Estonia, if central services are interrupted, 1600 healthcare providers are affected. Another parameter which may affect business continuity is the type of the model that is used in eHealth services. In case this model is not patient-centric, a patient may easily have hundreds of separate, overlapping records in various systems and this limits the availability of information , a condition which affects patient safety and leads to unnecessary duplication of tests and investigations, so it increases the cost of the services . Under the umbrella of systems availability falls also the application security for

Lack of interoperability

EHealth infrastructures include many diverse systems and applications interconnected at various scales i.e. a medical device collecting clinical data can be linked in the same network that a computer uses to access Internet. A core issue for an effective and secure use of these services is to ensure a high level of interoperability and guarantee that

information is transmitted safely through individual information systems, health service institutions, healthcare providers and patients and, on the other hand, that the recipient’s system is able to use the information received in order to proceed in various actions . For example, the vocabulary used in EHR, namely the terminologies, the classifications, the metadata , or the cloud services among different cloud service providers, local or external clouds, must be based on universally applied standards and an agreed-upon framework or some open protocols/APIs for secure information exchange and services integration .The lack of interoperability may also affect the security updates in an eHealth services network. For instance, some healthcare providers in Estonia still used Windows XP until the previous autumn, while all the software companies were about to stop producing updates for this operating system, so this was a significant obstacle to take all the necessary security measures for the stakeholders. In the current report, 25% of the survey respondents claimed that there is no interoperability framework in place at their organisation.

Access control and authentication

A recent study by KPMG showed that among the greatest vulnerabilities in data security is sharing data between third parties and insiders (breaches by employees). This finding indicates access control and authentication as key security features in eHealth infrastructures. Authentication is the initial stage of the users’ validation in order to determine their identity which is necessary to ensure that they are authorized to access the system. Once authenticated, the information level that they are allowed to view or share for organisational purposes is defined by 29 30 an access control policy . Access control is one of the main safeguards for ensuring data privacy and integrity . A centralised system (e.g. an HIS) with limited external connection has a specific perimeter which needs to be safeguarded. In such a case, internal user access control becomes a higher challenge than external access control. On the other hand, a distributed EHR or a mHealth chronic disease management system needs to prevent unauthorized access on data over the network. Apart from enforcing authentication and access control, the need to retain at the same time a user-friendly system is of great importance since it helps avoiding errors introduced by the user. Additionally, with respect to the prevention of inappropriate or illegal disclosure it is crucial for providers of health data to be sure that parties who consume data enforce, in turn, access constraints conformant to the purposes under which that data was provided. Therefore the definition and enforcement of access rules for health data and services throughout clinical workflows is a precondition for any cooperative patient treatment .

Data integrity

One of the most common cyber security challenges in eHealth is ensuring quality and integrity of the data that are stored and exchanged for clinical and administrative purposes. Examples include clinical laboratory test results, patient demographics, medication related information, radiology reports and images, pathology reports, hospital admission, discharge and transfer dates, etc. Data integrity is crucial, as errors in personal or clinical data may affect a person’s medical treatment, insurance or employability . These errors are often related to incorrect entry by staff,

Network Security

A fundamental challenge in securing eHealth infrastructures is considered to be network security, and according to the interviewees, this is highly related to many security incidents. Network security becomes critical when the security of other critical assets relies on the security of the network. This is a top priority when the eHealth system is network based (e.g. EHR/PHR, cross border eHealth). Recent reports indicate that one of the main vulnerabilities of an eHealth network are the inadequate firewalls by 27% and place the external attackers as one of the major threats by 65% , while the 81% of health care executives surveyed claim that their organisations experienced attacks by at least one malware, botnet or other cyber-attack during the past two years and only half feel that they are adequately prepared to prevent attacks .

Security expertise and awareness

A critical parameter for achieving and maintaining a high security level in eHealth systems and networks appears to be the security expertise. The security practices by personnel are considered a source of potential problems and appear to be a significant challenge, as in some countries, like Austria, the human factor is considered the most important cause of security incidents. Thus, ensuring that the security architecture and all the respective procedures and measures that must be followed are well designed, understood and applied by all relevant stakeholders in an organisation is of high importance. A critical factor which contributes to awareness raising is the appropriate, adequate and sufficient organisational structure and especially the role of a security officer. Nowadays 20% of healthcare providers don’t have a leader solely responsible for information technology security and -in some countries, like Estonia- a security officer placement is an organisational structure mandatory by law only for public sector. Therefore many concerns are raised for the private sector security practices, since the lack of this asset may 41 42 lead to misuse of security standards and a gap between security policy and work practices . Finally, another major concern regarding the lack of security expertise is that the 23% of organisations do not have a security operations centre to identify and evaluate threats .

Data loss

The digitalization of information and the high level of eHealth services penetration in the healthcare sector mean that a significant amount of vital, personal and confidential data are stored in digital format. In this framework, the protection of the data from loss is considered to be very important. On the other hand, sometimes it is impossible to avoid ending up in such a critical situation (e.g. software and hardware faults, network faults, security attacks, and natural disasters), so data recovery and the timeframe that it can be achieved is closely related to data loss. Common causes of data loss are unauthorised access to clinical patient data by IT vendors and by healthcare organisations personnel and the back-up policy . A European Hospital Survey on benchmarking the deployment of

eHealth services showed that 73% of the hospitals have an archiving strategy for long-term storage and disaster recovery, while 23% don’t and only 14% are able to proceed to an immediate recovery and 42% in less than 24 hours .

Standardisation, Compliance and trust

One of the main concerns in attaining security in eHealth infrastructures is the proper use and persistence to create, maintain and enforce an interoperability framework so that integrated systems contributes to cost reduction in eHealth . Some experts expressed concerns around the applied security policy from the third-party providers. The European Commission has foreseen this need and thoroughly studied it during the HITCH and ANTILOPE projects. In some countries, like Estonia, providers from the private sector are not obliged to comply with a specific and detailed security standard. Additionally, eHealth professionals in Estonia find the requirements defined in the data protection act to be abstract, something that results in problems in practice.

Cross-border incidents

Cross-border eHealth services play a significant role, especially in the European framework of free mobility for citizens across the EU, since it is one of the main instruments to reach globally the public health objectives ensuring the safety of emergency care and the continuity of non-emergency care. The challenges that shall be tackled in order to facilitate transferability of data in cross-border healthcare are mainly related to building a common interoperability and access control and authentication framework . For example, the Estonian ID-card is issued only to citizens and residents of Estonia. The Mobile-ID requires activation with an Estonian ID-card; consequently Mobile-ID is also available for Estonian residents only and there is no support for qualified certificates issued by other countries . The European Commission has invested substantial human and financial resources to prevent cross border incidents from happening. The extensive use of integration profiles such as IHE ATNA, provide effective logging of information exchange that minimise the case of cross border incidents.

Incidents management

Incidents management is a major challenge in eHealth security. Although 75% of the respondent’s implement security policies in their eHealth systems and/or infrastructures, there are incidents that can be neither anticipated nor avoided. Security incidents root causes include, human errors, natural phenomena, malicious actions (DDoS attack, MITM attacks, etc.) and system failures (including third party failure, i.e. hardware failure). System failures and human errors account equally for the majority of the incidents reported. Deliberate human intervention to disrupt the workflow (i.e. malicious actions) also accounts significantly for jeopardizing security, whereas the impact of natural phenomena accounts for a small only portion of the reported security incidents. It has to be noted that human factor may also relate to malicious actions, Figure 7 Common root causes of security incidents from the perspective of causing system holes by negligence or oversights, which could lead to system inefficiencies and thus make the infrastructures vulnerable to possible attacks. Human error also includes incorrect security practices by personnel which may result in security

incidents, so, apart from implementing cyber security measures, awareness raising and training are very important to building a secure system. Therefore, eHealth organisations need to have an incident response capacity, in order to timely identify incidents and restore and reconstitute systems and services in a trusted manner. Apparently, there is a need to develop an eHealth specific incident reporting, classification and alerting mechanism in pan European level. International good practices could be consulted towards this direction.

3.4 Information security requirements for eHealth

Security requirements, which the operators have to meet, are drawn from the legal framework of each EU MS, as well as the EU directives which have been transposed in the MS. The legal framework requirements are sometimes described at an abstract, non-technical level. Thus operators have to assess risks and security options and deploy appropriate measures, depending on ICT architecture and technology deployed.

Generally, the security objectives in eHealth, according to the interview respondents of the current report, are shown in the graph below.

Incidents Management

According to the findings of the conducted surveys and interviews, one of the top priorities in security appears to be the management of incidents. Many countries pointed that incident reporting is the key for improving security planning and measures. Some countries have already built helpdesks or reporting mechanisms. For example, in Ireland, there are regional incident helpdesks and the incidents are usually managed by the vendors, while the establishment of a single virtual helpdesk is planned. In Estonia the security officer of the eHelath Foundation reports to the Foundation’s management board and Ministry of Social Affairs reports directly to the CERT Estonia. In France, the eHealth authorities report directly to the security officer of the Ministry of Health. However, although there is an established mechanism for reporting and resolving incidents in these countries, there isn’t in place a regulatory framework and the action plan is based on informal guidelines. Furthermore, in Greece, the external eHealth services providers are contractually obliged to report incidents.

Physical and environmental security

The second top security requirement in eHealth is considered to be the physical and environmental security, which is usually included in the acts covering the protection of the national infrastructures in each country. This is a very wide subject which may refer either to the protection from physical disasters or to the mechanisms that protect infrastructures from intruders and control the entrance to restricted areas where they can gain access to specific information. A basic principle for the physical protection of data is to ensure that file servers are located in secure areas safeguarded from unauthorized access and environmental threats such as fire, flood, loss of power etc. Additionally, all equipment used to store or process critical data may be recorded and any movements tracked to ensure that any theft or loss is detected in time . In the UK, the physical security technologies that are used to control the entrance in restricted areas and use IT systems and communication over IP networks can be divided into three types: (a) Automatic Access Control Systems (AACS) (b) Closed Circuit Television (CCTV) (c) Intrusion Detection Systems (IDS) .

Network security

The network architecture and the network equipment (e.g. switches, routers, firewalls, anti-malware / anti-virus servers, security patches and updates servers, domain controllers, application servers, workstations, support laptops, event logging systems etc.) should be sufficient and meet the operational security requirements. On the other hand, network security also relates to secure data transmission. Therefore in many countries a secure connection platform is established exclusively for e-government or eHealth network. For example, in Ireland a platform was built for the exchange of health data, named Healthlink Online. It utilizes 128-bit SSL encryption and digital, client and server, certificates are required to initialize a TLS session. Data sent via a TLS connection is protected by encryption. It also employs the use of V-LANs, multiple firewalls and VPNs to ensure the data remains as secure as possible.

Access control

A very significant priority for ensuring security in eHealth appears to be access control, as it is the instrument to control data protection –both in terms of integrity and privacy- and ensure that the user who has access to a specific information is well-trained and able to use it efficiently for the appropriate purpose. Some of the main requirements for a secure access to patients’ data include :

a) The use of a unique identifying reference for each patient (the NHS number or similar); b) Access to the system permitted only where there is a “legitimate relationship” between the system user and the patient; c) Registration of all users with a central authority to obtain a smartcard and a pass code (chip and pin). For example, in Estonia there is a three-level authentication system used (notably): (i) knowledge-based authentication, where the server identifies the clients by their user names and passwords (ii) device-based authentication, where the server identifies the client using a specified object, such as a chip card, magnetic card or key (iii) biometrical authentication, where the server identifies clients by the voice, face, fingerprint or retina. d) Strict prohibitions on the sharing of access cards and passwords; e) “Role based” access for every registered user which defines the extent to which information can be accessed and amended. Staff will only be able to access as much information as is needed for the purpose of their role, for example, a clinic clerk may only have access to administrative information;

f) Introduce continuous manual or automatic auditing mechanisms of accesses made by staff as a requirement i.e. did the doctor really have a patient relationship while accessing the patient information? g) Data classification according to access levels. In Finland, the health information systems are separated into two groups: Group A can access the central eHealth hub after certification; Group B cannot access national services, but the system manufacturer must still make a self-declaration of compliance with guidelines, while compliance of Group A systems is checked by a third-party certification authority accredited to do so by the Finnish Communications Regulatory Authority. In Switzerland, there are three data classes, administrative data that can be seen by all professionals, utility data that can be seen by all healthcare providers (e.g. weight, laboratory test results, special follow-ups) and health data which are classified into three subcategories: (i) basic data, which can be seen by the healthcare providers to whom the patient has granted access (ii) stigmatizing data which can be seen only by healthcare providers, provided the patient has given his consent (iii) secret data, which also can be seen only by clinicians, provided the patient has given his consent; h) An audit trail (accountability) whereby records are kept of all instances of access to a patient’s care record, with alerts triggered when access is not justifiable. Specific individuals will be responsible for reviewing such alerts and taking appropriate action;

Business continuity and disaster recovery

As the continuous provision of health services to patients is a major concern, it is very important to ensure systems availability and recovery from incidents. In order to achieve business continuity in eHealth, organisations should meet several requirements:

i. Regular data and software back-up procedures in order to provide contingency backup; ii. Back-up copies of operational configuration files for the I.T. infrastructure including server and networked equipment (IP address ranges, firewalls, etc.) should be kept in a secure place. This will allow the quick recovery of the infrastructure if a disaster occurs . iii. The option not to deploy a central EHR repository in order to reduce the risk of illegitimate large scale data availability (e.g. Austrian ELGA approach).

Supplier chain/third party

The supplier chain/third party security is a common major concern in information security which also affects eHealth security. Several countries establish SLAs with ICT integrators, where security level requirements and incidents reporting are included.

Awareness raising and training

Also, awareness raising and training of the personnel is of high priority in order to enforce the knowledge on the information security processes and data protection procedures and consequently reduce human errors. In this direction, a very prevalent security measure is the placement of an IT security officer in every healthcare organisation. For example, HUG (Hôpitaux Universitaires de Genève) started employing a security officer five years ago. Appropriate training on the permitted use of patient information according to the relevant requirements of data protection law.

Risk management

Risk management turns out to be a significant objective in eHealth security, as it includes, firstly, the identification of critical assets and potential threats and, secondly, the risk analysis and impact evaluation of potential incidents on healthcare delivery and patients’ safety .

Further requirements

Furthermore, various approaches have been also stated, aiming at augmenting security:

 Compliance with international standards. The use of ISO standards and relevant security measures, have been referenced (i.e. ISO 27000 series and ISO 80001), especially in the deployment of internal information systems (such as HIS/CIS). IHE security measures (e.g. IHE ATNA, etc.) have been mentioned, especially in distributed use cases.  Internal and external security audits on a regular basis, in order to monitor the application of the security measures and the traces of the access in personal data. Government eHealth Agencies may be mandated to review Healthcare Operators and decide whether the latter need to take further protective ICT measures. For example, in France, hospitals are audited every 2-3 years by an independent organisation, named High Health Authority, in order to verify that their operation complies with the general and IT security standards. If a hospital does not follow the security requirements, then it is not able to acquire the security certification and has to stop accepting patients. In England, there is no specific framework for auditing, however there is a licensing program in place and the hospitals/GPs are obliged to mark their progress (self-assessment) to show that they comply with guidelines and policies (national toolkit).

4. eHealth Use Cases 4.1 Overview of Use Cases

This study identified several Health IT implementation scenarios (i.e. use cases) taking into account current trends

in eHealth , European Union policies in the domain and deployment models that are either widely accepted by the eHealth community or they are expected to emerge in the near future. The basic scope of those use cases is to study the impact of data integrity, data availability and resilience of eHealth infrastructures. Those use cases are presented in the following table.

Respondents ranked the level of criticality of these Use Cases, from low, medium low, high and very high, according to their experience and the contribution of these systems to their everyday job. The purpose of this criticality assessment is to identify the Use Cases that are most valuable to the eHealth community and therefore focus our future efforts in terms of research, good practices and recommendations.

The result of this qualitative analysis is depicted in the following diagram:

Please rate the use cases below based on their criticality (criticality of infrastructure, criticality of systems, criticality of data): (in average)

The diagram above establishes some initial conclusions on the existing and future deployment models in eHealth:

1. Criticality is noted as of most importance in cases where services are already deployed or under deployment, i.e. EHR/PHR operations, eHealth services, smart hospitals. 2. Criticality is correlated mostly to point of care delivery systems 3. Many respondents noted that some use cases may become dominant in the future but still have a lot of procedural, legal and administrative issues to be solved. This is the case for cloud services, mHealth and telemonitoring, cross border healthcare and big data and healthcare analytics.

Based on the above results, 3 uses cases are further analysed as interesting study cases that need to be assessed for security and data resilience. Those use cases are the ones that are already in use or have an important impact in matter of data integrity and resilience. The rest of the use cases are valid, but they are either expected to become prevalent in a medium to long term timeframe, or they have already established data integrity and resilience strategies from well-established protocols on which, end users and security officers have already specified countermeasures and security policies.

Those use cases are:

1) Cloud services in healthcare: Cloud services are a new phenomenon in healthcare. Disruption of those services may create discomfort, nevertheless, denial of service is usually not life threatening. Most respondents ranked this use case of high or very high impact in terms of criticality 2) EHealth services (ePrescription, Patient summary, referrals): Lack of eServices operation may create discomfort to end users. Most of the time those processes are transactional processes that deal with further value added services and administrative tasks (reimbursement, etc.). Most responders noted the high or very high importance of this use case, since such services are now the cornerstone of many national or regional health IT strategies. 3) EHR/PHR operations: EHR/PHR act as a supportive mechanism to point of care information systems. Many EU countries have deployed (for example, Luxembourg, Denmark, Finland, Estonia, France, Romania and other) or

are in the process of deploying such services (for example, Greece, Cyprus, Italy and other) aiming at providing value added services to citizens, healthcare providers and the public health policy. As such, they are gradually gaining recognition in the end user communities and they are considered critical information infrastructures while they acquire and reuse healthcare information.

4.2 Use Cases analysis

In this section, three use cases are analysed in detail. For each one of them, purpose and relevance are included. The study also reflects the domains where those use cases have been or could be potentially applied, the scale (cross border, national, regional or local deployment), the information that is exchanged and used and the key users, stakeholders that actively take part in each case. Additionally, security parameters are mentioned such as potential risks, security requirements, eHealth assets, and criticality. Finally, proposes some references of existing good practices in each use case.

Cloud Services in Healthcare

EHR/PHR Operations

EHealth Services

5. Recommendations 5.1 Recommendations

Based on the information presented in this study and given the status of eHealth security in the MS, we conclude by providing the following recommendations for further work in this area.

Recommendation 1: Member States should conduct an asset identification and a risk assessment activity to classify their critical eHealth infrastructures and services and develop a national catalogue.

Identification of critical eHealth infrastructures and assets is a process to evaluate several eHealth services (use cases) and supporting infrastructures, as well as to determine which ones are critical. Definition of several Criticality levels may also be an option. ENISA’s 2014 report on CII identification, having taken stock of practices followed in EU, provides alternative methods towards reaching this goal.

It is critical to achieve a uniform and adequate security level throughout critical eHealth infrastructures. The determination of such infrastructures and assets at a national level shall enable the systematic protection of the latter, based on national rules to be followed uniformly. Moreover this approach may lead to the concentration of protection efforts to the most critical eHealth infrastructures, based on a prioritisation scheme.

Defining what is critical can be a complex issue and the result may be disputable, given interdependencies between services and infrastructures. MS may start with a simple approach in the identification of critical eHealth infrastructures and follow an evolution process towards higher maturity. ENISA has made a good first step in this report and listed some of the assets that should be considered critical.

Recommendation 2: Member States should introduce clear cyber security guidelines for the protection of their critical eHealth infrastructures and services.

Define the minimum requirements for the protection of eHealth infrastructures and assets classified as critical and include them in clear cyber security guidelines. Such guidelines may refer to specific use cases and technical infrastructures and assets commonly deployed, in terms of their protection measures. Combined with the previous recommendation, these guidelines could form the basis for the development of a standard protection level for the critical eHealth Infrastructures and identified relevant assets.

Guidelines may not be observed due to budgetary limitations, lack of management commitment to eHealth security as well as limited training & skills. However clear incentives can help bypassing these obstacles.

Recommendation 3: Member States and healthcare organisations should perform an impact/cost benefit analysis of healthcare cyber security incidents and to use this as leverage for increasing investment on eHealth systems and infrastructures security.

Senior management echelons need to be motivated to increase budget for investing on cyber security and assets protection. The best way to explain this is to present the cost benefit analysis of the security incidents classified by root causes, to indicate how big the loss is. The healthcare organisations should provide statistical analysis based on actual facts, incidents that have caused also financial impact to the organisation, to convince higher management that security should be considered a priority regardless of the national legal framework.

Recommendation 4: Member States should develop incident response mechanisms to efficiently bring together the healthcare organisations with the national cyber security competent centres.

An eHealth incident reporting mechanism, potentially part of a clinical incident reporting and alerting system, may improve patient safety. Moreover, by effectively sharing such information at various levels nationally, organisationally and clinically, collaborative efforts can be made to improve critical eHealth infrastructure protection and patient safety. In practice, an eHealth focused Computer Emergency Response Team should be created, which could potentially collaborate with the national CERT on incident handling. Feedback directly to the eHealth service users (e.g. clinicians) is extremely important for their continued engagement. A culture that encourages reporting and information sharing is needed.

In terms of eHealth incident handling and hazard control, further steps need to be taken:

 Systems for reporting and analysing incidents both locally and nationally,  A good in-depth analysis process to establish root causes for selected individual incidents and aggregate incident reviews, thus enabling learning,  A process to ensure that actions are implemented and corresponding improvements in eHealth safety can be demonstrated,  Redefinition of compensation systems (punitive or non-punitive) and their impact on the patient safety culture and achievements.

Recommendation 5: Member States and healthcare organisations should setup an information sharing mechanism to start exchanging knowledge and lessons learnt on cyber security issues i.e. how they mitigate incidents, which are the security measures they take etc.

Information sharing is a very important component when building frameworks at a national level. Bringing stakeholders from the private and public sector, the users, the general practitioners, associations of pharmacists etc. would result in better depicting the current situation in the country, the gaps, the needs and thus developing concrete security requirements for the security and resilience of eHealth systems and services.

Recommendation 6: European Commission should encourage the development of baseline security measures for eHealth critical infrastructures and services. This should be done in coordination with the competent centres and the healthcare organisations operating the critical infrastructures.

To offer assistance to the healthcare practitioners and bodies, baseline security measures could be set by competent European authorities (national regulators, national security agencies etc.). Depending on the existing frameworks, these could be binding and mandatory through ad hoc legislation (thus requiring monitoring and auditing mechanisms to be in place) or through non-mandatory guidelines. Depending also on the maturity levels the security measures should be able to cover all different levels of sophistication in the systems.

Recommendation 7: Member States need to implement widely accepted security standards to achieve interoperability.

Define a set of must have integration profiles to establish secure connections over the network, specifically in the domains of audit logs, data encryption, TSL assertions, access rights policy, eID, healthcare providers’ registries, and many more related to data integrity and resilience of systems.

Having a common guideline on the way to ensure correct interoperability will gradually increase end user experience and acceptance of new type of services that are meant to run over open networks and not in closed and restricted networks.

Recommendation 8: Member States should invest in raising awareness of the citizens and healthcare organisations in providing cyber security training to personnel and users.

One of the greatest gaps identified in this study is the lack of expertise and knowledge on cyber security, with consequent risks for the people involved in healthcare. Officers working in the competent authorities and the healthcare units (hospitals, clinics etc.) should understand the concepts of cyber security risks to be able to protect the critical assets.

Recommendation 9: Member States policy makers should make sure that eHealth should align with the national CIIP strategy and with the National Cyber Security Strategy (NCSS).

The NCSS is the policy document that describes the activities the country should take to enhance cyber security at a national level in the public, private sector and citizens. One of the most important objectives of the NCSS is Critical Information Infrastructures Protection (included in 90% of the existing EU NCSS ). As healthcare is considered a critical information infrastructure, any ehealth strategy should be aligned with the national policy documents and activities. This applies to all MS the ones that have already a strategy and the ones in process of creating one, including this way ehealth systems security and protection in the national priorities.

5.2 Future work

In more detail, the study identified also several areas where future work needs to be done:

1. Guidelines need to be created concerning CIIP in eHealth since many countries do not have a specific policy in the domain. 2. Further analysis on the factors which govern the criticality of eHealth services and infrastructures (e.g. the nature of interdependencies). Goal is to produce a guideline on methods to apply in order to formally identify critical eHealth infrastructures. 3. Further drill down on specific eHealth use cases of interest (review the technology and architecture used, the specific threat and risk mitigation measures to be taken). More specifically to thoroughly study the Cloud implementation in healthcare, presenting the related challenges and opportunities. 4. As eHealth is a prominent sector for automation and it can be supported by Smart solutions, a specific analysis on the Smart Hospitals pilots from the cyber security perspective should be considered.

6. Appendix - Glossary of Terms and Acronyms 6.1 Acronyms 6.2 Glossary of basic terms

ENISA

European Union Agency for Network and Information Security Science and Technology Park of Crete (ITE) VassilikaVouton, 700 13, Heraklion, Greece

Athens Office

1 Vass.Sofias&Meg.Alexandrou Marousi 151 24, Athens, Greece Catalogue Number TP-04-15-824-EN-N

PO Box 1309, 710 01 Heraklion, Greece ISBN: 978-92-9204-137-3 doi:10.2824/217830 Tel: +30 28 14 40 9710 info@enisa.europa.eu www.enisa.europa.eu